You have just noticed a warning that a recent login to your online banking or email was from a new device. The alert suggests that someone else might be trying to access the account. Adding a second verification step can block that attempt, but setting it up correctly is essential to avoid being locked out yourself. This guide explains what the extra layer stops, which accounts deserve the first attention, how to choose a reliable method, and how to keep a safe fallback when the primary device is unavailable.
What the second factor stops
A password alone protects against casual guessing, but it does not verify that the person entering it actually owns the device associated with the account. A second factor requires something the user possesses, such as a code generated on a phone, which an attacker cannot reproduce without physical access. This extra step blocks many common attacks, including credential stuffing and phishing attempts that capture passwords. If the password is compromised, the attacker still needs the second factor to complete the login, dramatically reducing the chance of unauthorized access.
Text messages versus authenticator apps
Receiving a code by SMS is convenient because it works on any phone that can receive messages, but the delivery channel is vulnerable to interception, SIM swapping, and carrier outages. An authenticator app creates time‑based codes on the device itself, eliminating reliance on the carrier network and making it harder for a third party to obtain the code. The app method also works offline and typically updates the code every 30 seconds, providing a stronger guarantee that only the device in your possession can generate a valid code.
A third option is a hardware security key, a small physical device that you plug in or tap to confirm a sign-in. It is the strongest option and is mainly used by people with higher security needs. Check whether the service offers it in its security settings. Because a key is a physical item, keep it safe, and make sure you have backup codes in case you lose it.
Start with email accounts
Email serves as the recovery hub for many other services, so securing it first prevents attackers from resetting passwords elsewhere. When you enable two‑factor authentication on your primary email address, you create a barrier that protects linked accounts such as social media, shopping, and cloud storage. The extra protection is modest in daily friction but offers a high return because a compromised email can unlock a cascade of other services.
If you get an unexpected login alert
If a login alert arrives and you did not expect it, take these steps in order. Start with the safest checks.
- Check the alert is genuine. Do not click any link in it. Open the service yourself, by typing its address or using its official app. If your account has a list of recent sign-ins and the same new sign-in appears there, the alert matches a real sign-in on the account. That does not prove the sign-in was yours, so carry on with the steps below.
- Change your password. Use a new password that you do not use anywhere else. You may then be asked to sign in again with the new password.
- Sign out other devices. Where the service offers it, sign out of all other sessions. Other devices should then need to sign in again before they can reach the account. A session is one signed-in login to your account, usually on one device or in one browser.
- Turn on two-factor authentication. Follow the steps in the next section.
How to turn on two-factor authentication
This guide is general and does not cover one service in particular. Names and places vary between services, and between versions of the same app or website, so use these steps as a rough map. Look for words such as security or two-step verification in your account settings.
- Sign in to the account with your current password, from the official site or app. You should now see your account home page.
- Find the security settings. Look for a section called security, sign-in, or two-step verification. You should now see a list of ways to protect your sign-in.
- Choose a method. Common choices are an authenticator app (an app that makes codes on your phone), a text message code, or a hardware security key. You should now see a screen that asks you to pick one.
- Follow the prompts. The service will ask you to link the method you chose, for example by scanning a code with your authenticator app. You should now see a message confirming that the second step is on.
- Save your backup codes somewhere safe. If the service shows backup codes, keep them offline, as explained below. You should now see a message that the codes were created.
Never share a code
A one-time code is only meant for you, while you are signing in. A fake login page can ask for your password and code, then pass them on in real time, so an attacker can use the code before it expires. Enter codes only on a login page that you opened yourself. Do not type a code, password or card details into a page you reached from a message link. Open the official site or app yourself.
Treat any call, text or message that asks for a code as a scam. A genuine service or support person will not ask you to read out or forward a code. Never share a verification code with anyone who asks for it, even if they say they are from a company you trust.
Backup codes and safe storage
Backup codes are one‑time passwords that can be used when the regular second factor is unavailable. They should be printed or written down and stored in a secure location separate from the phone, such as a locked drawer or a password‑protected digital note. Keeping them offline protects against malware that might steal app‑generated codes, and having multiple copies reduces the risk of losing access if one copy is misplaced.
If the phone with codes is lost
Losing the device that holds your authenticator app removes the primary source of second‑factor codes. Before this happens, make sure you have backup codes saved and that the account recovery options (alternative email or phone number) are up to date. After the loss, use the backup codes to log in, then replace the authenticator app on a new device. A backup code should let you sign in without the lost device. If backup codes are also missing, contact the service’s support team and be prepared to verify identity through other means.
Accounts where the small friction is worth it
Financial services, cloud storage, and any platform that stores personal documents or payment information benefit most from two‑factor authentication. The occasional extra step of entering a code is a minor inconvenience compared with the potential loss of money or sensitive data. Even social media accounts can be worthwhile to protect because they often serve as a gateway to password reset links for other services.
Worth remembering: Enable two‑factor authentication on your primary email first, use an authenticator app rather than SMS, and keep printed backup codes in a secure place; this combination blocks most unauthorized logins while providing a reliable way to regain access if your phone is lost.
Common questions
Can I use the same authenticator app for multiple accounts?
Yes, most authenticator apps allow you to add several accounts, each with its own code, and they store the keys securely on the device.
What should I do if I cannot receive SMS codes because I am traveling abroad?
Switch to an authenticator app before the trip, or ensure backup codes are saved and accessible without network service.
Is it safe to store backup codes in a cloud note?
Storing backup codes in a cloud note is acceptable only if the note is protected by a strong, unique password and, if possible, its own two‑factor authentication.
Last updated: October 9, 2026